How To Work With WebGoat

Welcome to a brief overview of WebGoat.

Environment Information

WebGoat uses the Apache Tomcat server but can run in any application server. It is configured to run on localhost although this can be easily changed.

The WebGoat Interface



1. These are Lesson Categories in WebGoat. Click on a Category to see all Lessons in it.
2. This will show the underlying Java source code.
3. This will show the complete solution of the selected lesson.
4. This will show goals and objectives of the lesson.
5. This will show technical hints to solve the lesson.
6. This will show the HTTP request data
7. If you want to restart a lesson you can use this link.

Solve The Lesson

Always start with the lessons plan. Then try to solve the lesson and if necessary, use the hints. The last hint is the solution text if applicable. If you cannot solve the lesson using the hints, you may view the solution for complete details.

Read And Edit Parameters

To read and edit Parameters you need a local proxy to intercept the HTTP request. Here we use OWASP ZAP. More information on ZAP can be found in the "Useful Tools" Chapter.

Read And Edit Cookies

Often it is not only necessary to change the value of the parameters but to change the value of cookies. OWASP ZAP has functionality for this as well.

Configuring new WebGoat users

WebGoat uses spring-security.xml to configure users.

<!-- Authentication Manager -->
<authentication-manager alias="authenticationManager">
  <authentication-provider>
    <user-service>
      <user name="guest" password="guest" authorities="ROLE_WEBGOAT_USER" />
      <user name="webgoat" password="webgoat" authorities="ROLE_WEBGOAT_ADMIN" />
      <user name="server" password="server" authorities="ROLE_SERVER_ADMIN" />
    </user-service>
  </authentication-provider>
</authentication-manager>  
  

Adding Users

Usually using WebGoat you just use the user guest with the password guest. But maybe in laboratory you have made a setup with one server and a lot of clients. In this case you might want to have a user for every client and you have to alter /WEB-INF/spring-security.xml as the users are stored there. We recommend not to use real passwords as the passwords are stored in plain text in this file!

Add User

Adding a user is straight forward. You can use the guest entry as an example. The added users should have the same role as the guest user. The new user/password will not show on the login page. Add lines like this to the file:

<user name="guest2" password="guest2" authorities="ROLE_WEBGOAT_USER" />
...